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It is pointed out that two separated quantum channels and three classical authenticated channels 
are sufficient resources to achieve detectable broadcast. 
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This note is about broadcast (or byzantine agreement), 
and should be considered as a follow-up of the paper [l| . 

In its simplest form, broadcast is a task involving three 
parties: a sender, S, and two receivers, Ro and R\. The 
sender holds an input value x s £ CD (D denotes some 
finite domain) and is supposed to send it to the two re- 
ceivers. The two receivers eventually decide on an input 
value in CD. Amongst S, Rq and Ri, one (and at most 
one) player may be an active adversary and try to stop 
the two other parties to agree on an input value. The 
other two parties are said to be honest. 

A protocol achieves broadcast if (i) it guarantees that 
all honest players decide on the same output value y £ CD, 
(ii) y = x s whenever the sender is honest. One easily sees 
the difficulties involved in this task if only pairwise (clas- 
sical) authenticated channels are available. For example, 
a cheating sender could send different bit values to Ro 
and R\. Thus Ro and R\ should test the honesty of S 
during a phase of the protocol where they exchange their 
input and check whether they match. But if one of the 
receivers is dishonest, it might happen that, during this 
verification phase, he sends the other receiver a value dif- 
ferent from the input he actually got from the sender. In 
fact, it is known that, if the only resource available to the 
three players is pairwise authenticated channels, broad- 
cast is impossible 0- However, when quantum channels 
are available, a variant of the byzantine agreement prob- 
lem, namely detectable broadcast, can be achieved. A 
protocol is said to achieve detectable broadcast if (i) it 
achieves broadcast when no player is corrupted, (ii) when 
one player is corrupted, then either the protocol achieves 
broadcast, or all honest players abort the protocol. 

Let |0), |1), |2) denote an orthonormal basis of a qutrit 
system (a qutrit is a three- level quantum system). De- 
tectable broadcast can be achieved if the three players 
share many copies of the so-called Aharonov state [jj 
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and perform measurements on this state. 

Actually, the protocol described in [| is such that 
the source of Aharonov states lies at i?i's site. Clearly, 
Byzantine agreement works as well if R\ were preparing 
the state and measuring her qutrit before send- 

ing their qutrits to players Rq and S. Therefore, in- 
stead of using \A), Ri can as well prepare randomly ei- 
ther of the three iwo-qutrit states \Aq), \A±), IA2), where 



\A ) = 2- 1 / 2 (|l,2) - |2,1)) (\At) and \A 2 ) are defined 
likewise). It is thus clear that Byzantine agreement can 
be achieved using only two quantum channels distribut- 
ing entangled states. 

But even further simplifications can be brought: 
\Aq). \ A\), constitute more resources than the three 
players actually need. An examination of the protocol 
described in [l| shows that to achieve broadcast, all we 
need is to meet the five following conditions: 

1. Ro and R\ share an n-trit string K° = fc° . . . 

2. S and i?i share an n-trit string K s = kf . . . fc*; 

3. Vj = l...n, k^kf, 

4. Vj = 1 . . . n, Rq has no information about fe| other 
than fc° ^ /,•;: 

5. Vj = 1 . . . n, S has no information about k® other 
than fc° ^ fcj. 

These conditions can be simply satisfied as follows. Ri 
uses two quantum channels to distribute private n-trit 
strings (or keys) K° to Ro and K s to S, by means of 
a quantum key distribution (QKD) protocol |5| such as 
BB84 for example |3j . The keys K° and K s are supposed 
to satisfy the above conditions. There are two ways in 
which i?i could have not done her job properly: (i) the 
condition 4 or the condition 5 is not satisfied, i.e. the 
keys are not secret, (ii) the condition 3 is not satisfied. 

A violation of condition 4 or condition 5 would imply 
that Ri cooperates with another player to cheat the third 
one. This possibility is ruled out by the assumption that 
there is at most one cheater. A test of condition 3 can 
be performed by Ro and S (with arbitrarily high statis- 
tical confidence), upon Ro sending S a randomly chosen 
sample of his key. If this test fails, the protocol should 
abort. 

Thus, either Ri does her QKD job properly (and this 
fact is acknowledged by Ro and R\) or the protocol will 
abort. Assuming the first alternative, one can see, re- 
peating all steps of the protocol described in p|, that 
detectable broadcast can be achieved, using the three au- 
thenticated channels, exactly as if Aharonov states had 
been used. 

The essential reason why two QKD channels are 
enough to achieve broadcast is that R\ almost never talks 
during the protocol described in |]J . Actually, it was al- 
ready pointed out that no entanglement is necessary to 
achieve detectable broadcast. A scheme involving three 
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FIG. 1: Configuration necessary to achieve broadcast. Ar- 
rows indicate the direction of the information flow. Wavy 
lines represent quantum channels, and straight lines represent 
(classical) authenticated channels. 



quantum channels and QKD was proposed in The 
contribution of this note is to show that only two QKD 
channels are enough. 
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